@unchainedshop/api 2.8.18 → 2.9.1

package/src/roles/all.ts

@@ -1,3 +1,5 @@
+import { Context } from '@unchainedshop/types/api.js';
+
 export const all = (role, actions) => {
   const isInLoginMutationResponse = (root) => {
     // eslint-disable-next-line
@@ -7,6 +9,27 @@ export const all = (role, actions) => {
     return false;
   };
 
+  const isOwnedToken = async (_: never, { tokenId }: { tokenId: string }, context: Context) => {
+    const { modules, userId, user } = context;
+
+    const token = await modules.warehousing.findToken({ tokenId });
+    if (!token) return true;
+
+    const isOwnedByUser =
+      token.userId === userId ||
+      user?.services?.web3?.some((service) => {
+        return service.address === token.walletAddress && service.verified;
+      });
+
+    if (isOwnedByUser) return true;
+
+    const accessKeyHeader = context.req.headers['x-token-accesskey'];
+    const accessKey = await context.modules.warehousing.buildAccessKeyForToken(tokenId);
+    if (accessKeyHeader === accessKey) return true;
+
+    return false;
+  };
+
   role.allow(actions.viewEvent, () => false);
   role.allow(actions.viewEvents, () => false);
   role.allow(actions.viewUser, () => false);
@@ -31,8 +54,6 @@ export const all = (role, actions) => {
   role.allow(actions.managePaymentProviders, () => false);
   role.allow(actions.manageDeliveryProviders, () => false);
   role.allow(actions.manageWarehousingProviders, () => false);
-  role.allow(actions.updateToken, () => false);
-  role.allow(actions.viewToken, () => false);
   role.allow(actions.manageAssortments, () => false);
   role.allow(actions.manageFilters, () => false);
   role.allow(actions.manageUsers, () => false);
@@ -49,14 +70,6 @@ export const all = (role, actions) => {
   role.allow(actions.markOrderRejected, () => false);
   role.allow(actions.markOrderPaid, () => false);
   role.allow(actions.markOrderDelivered, () => false);
-  role.allow(actions.viewLogs, isInLoginMutationResponse);
-  role.allow(actions.viewUserRoles, isInLoginMutationResponse);
-  role.allow(actions.viewUserOrders, isInLoginMutationResponse);
-  role.allow(actions.viewUserTokens, isInLoginMutationResponse);
-  role.allow(actions.viewUserQuotations, isInLoginMutationResponse);
-  role.allow(actions.viewUserPrivateInfos, isInLoginMutationResponse);
-  role.allow(actions.viewUserEnrollments, isInLoginMutationResponse);
-  role.allow(actions.viewUserProductReviews, isInLoginMutationResponse);
   role.allow(actions.reviewProduct, () => false);
   role.allow(actions.updateProductReview, () => false);
   role.allow(actions.manageProductReviews, () => false);
@@ -82,26 +95,42 @@ export const all = (role, actions) => {
   role.allow(actions.manageTwoFactor, () => false);
   role.allow(actions.impersonate, () => false);
   role.allow(actions.stopImpersonation, () => false);
+  role.allow(actions.viewTokens, () => false);
+
+  // special case: when doing a login mutation, the user is not logged in technically yet,
+  // but should be able to see user data of the user that is about to be logged in
+  role.allow(actions.viewLogs, isInLoginMutationResponse);
+  role.allow(actions.viewUserRoles, isInLoginMutationResponse);
+  role.allow(actions.viewUserOrders, isInLoginMutationResponse);
+  role.allow(actions.viewUserTokens, isInLoginMutationResponse);
+  role.allow(actions.viewUserQuotations, isInLoginMutationResponse);
+  role.allow(actions.viewUserPrivateInfos, isInLoginMutationResponse);
+  role.allow(actions.viewUserEnrollments, isInLoginMutationResponse);
+  role.allow(actions.viewUserProductReviews, isInLoginMutationResponse);
+
+  // special case: access to token sometimes works via a X-Token-AccessKey Header and thus should also be allowed for anonymous users
+  role.allow(actions.updateToken, isOwnedToken);
+  role.allow(actions.viewToken, isOwnedToken);
 
-  // only allow if query is not demanding for drafts
+  // only allow if query is not demanding for drafts or inactive item lists
   role.allow(actions.viewProducts, (root, { includeDrafts }) => !includeDrafts);
+  role.allow(actions.viewAssortments, (root, { includeInactive }) => !includeInactive);
+  role.allow(actions.viewCountries, (root, { includeInactive }) => !includeInactive);
+  role.allow(actions.viewCurrencies, (root, { includeInactive }) => !includeInactive);
+  role.allow(actions.viewFilters, (root, { includeInactive }) => !includeInactive);
+  role.allow(actions.viewLanguages, (root, { includeInactive }) => !includeInactive);
+  role.allow(actions.search, (root, { includeInactive }) => !includeInactive);
 
   // public
   role.allow(actions.viewUserPublicInfos, () => true);
   role.allow(actions.viewProduct, () => true);
-  role.allow(actions.viewLanguages, () => true);
   role.allow(actions.viewLanguage, () => true);
-  role.allow(actions.viewCountries, () => true);
   role.allow(actions.viewCountry, () => true);
-  role.allow(actions.viewCurrencies, () => true);
   role.allow(actions.viewCurrency, () => true);
   role.allow(actions.viewShopInfo, () => true);
-  role.allow(actions.viewAssortments, () => true);
   role.allow(actions.viewAssortment, () => true);
   role.allow(actions.viewFilter, () => true);
-  role.allow(actions.viewFilters, () => true);
   role.allow(actions.viewTranslations, () => true);
-  role.allow(actions.search, () => true);
   role.allow(actions.logout, () => true);
   role.allow(actions.logoutAllSessions, () => true);
   role.allow(actions.loginAsGuest, () => true);

package/src/roles/index.ts

@@ -59,6 +59,7 @@ const actions: Record<string, string> = [
   'manageWarehousingProviders',
   'updateToken',
   'viewToken',
+  'viewTokens',
   'manageAssortments',
   'manageFilters',
   'createCart',

package/src/roles/loggedIn.ts

@@ -2,15 +2,18 @@ import { Context } from '@unchainedshop/types/api.js';
 import { User } from '@unchainedshop/types/user.js';
 
 export const loggedIn = (role: any, actions: Record<string, string>) => {
-  const isMyself = (
-    user: User,
-    foreignUser: { userId?: string } = {},
-    ownUser: { userId?: string } = {},
-  ) => {
-    if (user && user.username && user.services && user.emails && !foreignUser.userId) {
+  const isMyself = (user: User, params: { userId?: string } = {}, ownUser: { userId?: string } = {}) => {
+    // user wants to access a field of a user
+    if (user && !params.userId) {
       return user._id === ownUser.userId;
     }
-    return foreignUser.userId === ownUser.userId || !foreignUser.userId;
+    if (params.userId) {
+      // user wants to access a user object by userId
+      return params.userId === ownUser.userId;
+    }
+
+    // user wants to access himself
+    return true;
   };
 
   const isOwnedEmailAddress = (obj: any, params: { email?: string }, { user }: Context) => {
@@ -190,21 +193,6 @@ export const loggedIn = (role: any, actions: Record<string, string>) => {
     return credentials.userId === userId;
   };
 
-  const isOwnedToken = async (
-    obj: any,
-    { tokenId }: { tokenId: string },
-    { modules, userId, user }: Context,
-  ) => {
-    const token = await modules.warehousing.findToken({ tokenId });
-    if (!token) return true;
-    return (
-      token.userId === userId ||
-      user?.services?.web3?.some((service) => {
-        return service.address === token.walletAddress && service.verified;
-      })
-    );
-  };
-
   role.allow(actions.viewEvent, false);
   role.allow(actions.viewEvents, false);
   role.allow(actions.viewUser, isMyself);
@@ -240,8 +228,6 @@ export const loggedIn = (role: any, actions: Record<string, string>) => {
   role.allow(actions.voteProductReview, () => true);
   role.allow(actions.registerPaymentCredentials, () => true);
   role.allow(actions.managePaymentCredentials, isOwnedPaymentCredential);
-  role.allow(actions.updateToken, isOwnedToken);
-  role.allow(actions.viewToken, isOwnedToken);
   role.allow(actions.stopImpersonation, () => true);
   role.allow(actions.impersonate, () => false);
   role.allow(actions.confirmMediaUpload, () => true);

package/src/schema/mutation.ts

@@ -896,7 +896,10 @@ export default [
       """
       Sign a generic payment provider for registration
       """
-      signPaymentProviderForCredentialRegistration(paymentProviderId: ID!): String
+      signPaymentProviderForCredentialRegistration(
+        paymentProviderId: ID!
+        transactionContext: JSON
+      ): String
 
       """
       Sign a generic order payment
@@ -911,6 +914,7 @@ export default [
       """
       Tokenize
       """
+      invalidateToken(tokenId: ID!): Token!
       exportToken(tokenId: ID!, quantity: Int! = 1, recipientWalletAddress: String!): Token!
 
       """

package/src/schema/query.ts

@@ -205,6 +205,11 @@ export default [
       """
       token(tokenId: ID!): Token
 
+      """
+      Get all tokens
+      """
+      tokens(limit: Int = 10, offset: Int = 0): [Token!]!
+
       """
       Returns total number of payment providers, optionally filtered by type
       """

package/src/schema/types/order/item.ts

@@ -29,6 +29,7 @@ export default [
       discounts: [OrderItemDiscount!]
       dispatches: [Dispatch!]
       configuration: [ProductConfigurationParameter!]
+      tokens: [Token!]!
     }
   `,
 ];

package/src/schema/types/product/tokenized-product.ts

@@ -54,6 +54,8 @@ export default [
       contractAddress: String
       contractStandard: SmartContractStandard
       contractConfiguration: ContractConfiguration
+      tokens: [Token!]!
+      tokensCount: Int!
     }
   `,
 ];

package/src/schema/types/warehousing.ts

@@ -44,12 +44,19 @@ export default [
 
     type Token @cacheControl(maxAge: 0, scope: PRIVATE) {
       _id: ID!
-      user: User
-      walletAddress: String
       product: TokenizedProduct!
       status: TokenExportStatus!
       quantity: Int!
+      isInvalidateable: Boolean!
+      """
+      Get an access key that you can pass along the HTTP Header "x-token-accesskey" to access the token anonymously.
+      """
+      accessKey: String!
+      invalidatedDate: DateTime
+      user: User
+      expiryDate: DateTime
       contractAddress: String
+      walletAddress: String
       chainId: String
       chainTokenId: String
       ercMetadata(forceLocale: String): JSON